Privacy notice

Who is responsible for your data

The controller is Balogh Brendon Julián, sole trader (egyéni vállalkozó; registered office: Zöld utca 37., 9081 Győrújbarát, Hungary; sole-trader registration number: 63027213; tax number: 92520314-1-28). In this notice, “we” and “us” mean him, the controller.

For any question or request about your data, write to hello@oxilys.app, or by post to the address above.

We have not appointed a data protection officer, because Article 37 GDPR does not require one here: we are not a public authority, and our core activities do not involve large-scale, regular monitoring of people or large-scale processing of special categories of data.

When you visit the website

The website is served by Netlify. Like every web server, Netlify logs incoming requests. A log entry contains your IP address, your browser’s identifier (user agent), the address of the page you opened and the time of the request. These logs are needed to deliver the site to you, keep it secure, and investigate errors and abuse. Netlify keeps them for less than 30 days under its own rules. We cannot see the raw logs ourselves, we do not build visitor statistics from them, and we do not combine them with other data.

Cloudflare runs the name servers for oxilys.app but does not sit between you and the website: your visits do not pass through Cloudflare, and it does not see them.

The website uses no cookies, analytics, tracking code, third-party fonts or embedded content. The page contacts no server other than Netlify; its security settings forbid it. One thing runs in your browser: on the Hungarian pages, if your browser’s language is not Hungarian, the page offers a “Read in English?” suggestion. To do this it reads your browser’s language setting, in your browser only; nothing is sent to us. If you answer the suggestion, the page saves one setting in your browser’s local storage so that it does not ask again. That setting stays in your browser and is not sent to us; the Cookie policy describes it.

When you email us

You can write to hello@oxilys.app to ask for a beta invite, to be among the first testers of the phone app, or about anything else. We then receive your email address, your name (if it appears in the message or the sender details), what you write and any attachments, and the message’s technical data (for example the time it was sent and the headers mail servers add).

Email sent to hello@oxilys.app is forwarded by Cloudflare’s email forwarding service (Email Routing) to the controller’s Gmail mailbox. Only the controller reads your emails, and replies come from him, at baloghbren2@gmail.com. If you get a message about Oxilys from that address, it is from us.

We use the data in your emails to answer you and, if you asked, to invite you to the beta or to let you know when phone-app testing starts. We do not use it for anything else, and we do not sell it.

If you asked us to let you know when phone-app testing starts, you can tell us to stop at any time; we then delete your request.

If we invite you to the beta, we add your email address to the Oxilys app’s account system so that you can sign in with it. From then on, the data that belongs to your app account is covered by the app’s own privacy notice.

Whether you write to us is up to you. If you don’t, we hold no such data about you. If you wrote and changed your mind, you can ask us to delete your messages at any time.

Our legal bases

• Requests for a beta invite or phone-app testing: steps taken at your request before entering into a contract (creating your app account) (Article 6(1)(b) GDPR).
• Answering any other email: our legitimate interest in replying to messages sent to us (Article 6(1)(f) GDPR).
• Delivery logs and the email forwarding log: our legitimate interest in delivering the website and our email to you and keeping them secure (Article 6(1)(f) GDPR).

Legitimate interest

Where we rely on legitimate interest, we have weighed it against your interests and rights and concluded that it does not override them. We will show you this assessment on request. You can object to this processing at any time (see “Objecting” below).

How long we keep your data

Emails are not deleted automatically: we review them by hand every quarter and delete, at that review, every email whose retention period below has ended. If you ask, we delete any of your emails sooner.

• Emails asking for a beta invite: until the beta ends, but at most 48 months from receipt; sooner if you ask us to delete them.
• Emails asking to test the phone app: until phone-app testing ends, but at most 48 months from receipt; sooner if you ask us to delete them.
• All other emails: for 12 months after the conversation ends, or sooner if you ask us to delete them. If an email relates to a legal claim, until that claim is time-barred: in general five years under section 6:22 (1) of Hungary’s Civil Code (Act V of 2013).
• Delivery logs: Netlify keeps them for less than 30 days under its own retention rules; we have no access to them.
• Cloudflare keeps a log of forwarded emails (sender, recipient, subject, time) for about 30 days. It does not store the emails themselves.

Who can access your data

Only the controller has access to the mailbox that receives your emails. We do not sell your data or pass it to anyone for advertising. These providers handle it, only so that the website and our email work:

• Netlify, Inc. (101 2nd Street, San Francisco, CA 94105, USA; privacy@netlify.com): our hosting provider. It serves the website and keeps the delivery logs. It acts as our processor under its data processing agreement with us.
• Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA; privacyquestions@cloudflare.com): runs the name servers for oxilys.app and forwards email sent to hello@oxilys.app to our mailbox. It does not store the content of the emails, and it keeps a log of the forwarding (see above). It acts as our processor under its data processing agreement with us.
• Google (Gmail): provides the baloghbren2@gmail.com mailbox. Your emails arrive and are stored there, and we reply from it. In the European Economic Area, Gmail is provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) under its own terms and privacy policy.

If a provider changes

If email starts arriving in a different mailbox, or any provider changes, we update this list together with the change, and the notice gets a new version number. We disclose data to authorities only where the law requires it.

How we protect your data

The website is served over an encrypted connection (HTTPS) only, and its security settings prevent the page from contacting any server other than its host. Our Netlify, Cloudflare and Google accounts are protected with two-factor authentication, and only the controller has access to the mailbox. We keep little data: no forms, no analytics, no visitor database.

Transfers outside the EU

Netlify and Cloudflare are US companies, so delivery logs and forwarded emails may reach the United States. Both are certified under the EU-U.S. Data Privacy Framework, which the European Commission has found adequate (Implementing Decision (EU) 2023/1795; Article 45 GDPR). If the framework ceased to apply, the standard contractual clauses adopted by the European Commission, which are part of their data processing agreements, would continue to protect your data (Article 46 GDPR).

Gmail’s provider, Google Ireland Limited, is based in the EU. According to Google, data may also be transferred to the United States, for which Google likewise relies on the EU-U.S. Data Privacy Framework and standard contractual clauses.

Your rights

Free of charge, by writing to hello@oxilys.app or by post, you can ask us:

• for access to your data and a copy of it (Article 15 GDPR);
• to correct inaccurate data (Article 16);
• to delete your data (Article 17);
• to restrict how we use your data (Article 18);
• to give you the data you provided with your beta request in a machine-readable format (portability, Article 20).

Before we release a copy of your data or change it at your request, we check that the request really comes from you. Usually it is enough that you write from the email address your messages came from; if that is unclear, we may ask for more information to confirm your identity.

Objecting

You can object at any time to processing based on legitimate interest (Article 21 GDPR). We may then continue only if we have compelling legitimate grounds that override your interests, or if we need the data for a legal claim.

You can also object at any time to us contacting you about the start of phone-app testing or similar news (Article 21(2) GDPR); we then stop immediately.

We answer every request within one month at the latest. Where many or complex requests make it necessary, we may extend this by two further months, and we tell you so within the first month.

Delivery logs do not contain your name, and we cannot access them ourselves. If your request concerns them, give us your IP address and the time of your visit; we pass the request on to Netlify, which keeps the logs on our behalf.

Complaints

If you think we have breached your data protection rights, it is worth writing to us first, as we may be able to sort it out quickly. This is not a condition for going elsewhere.

You can complain to the Hungarian data protection authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH): Falk Miksa utca 9-11., 1055 Budapest; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu; naih.hu. If you live or work in another EU member state, you can also complain to the authority there (Article 77 GDPR).

You can also go to court (Article 79 GDPR; section 23 (3) of Hungary’s Act CXII of 2011 on informational self-determination). You may bring the case before the regional court (törvényszék) where you live or are staying, if you prefer.

Automated decisions

We make no automated decisions about you and do no profiling.

Changes to this notice

If the way we handle your data changes, we update this notice together with the change and publish it here with a new version number.

Summary table